Presumption of conformity: How EU harmonised standards shortcut AI Act compliance

A presumption of conformity is a legal shortcut. If a company builds its high-risk AI system according to a harmonised standard, EU authorities start from the assumption that the system meets the matching legal requirement. The company does not have to argue the point from scratch.

The mechanism is now live for the EU AI Act. It was triggered by the first harmonised standard for the law, EN 18286:2026, as covered in our news story.

Following a recipe instead of proving the dish is safe

Think of a food business. The law says a kitchen must be hygienic, but “hygienic” is vague. A published, official checklist turns the vague word into concrete steps. A kitchen that follows the checklist is assumed to be hygienic. A kitchen that skips it may still be fine, but the owner must prove it.

The AI Act works the same way. The law sets broad requirements for high-risk AI, such as risk management, human oversight and record keeping. Those requirements are written in legal language. A harmonised standard translates one of them into technical steps that an engineer can follow and an auditor can check.

What the law says and what the presumption covers

The rule sits in Article 40 of the AI Act. According to the text, high-risk AI systems that conform to harmonised standards, or parts of them, are presumed to comply with the relevant requirements. Two conditions apply. The standard must be referenced in the Official Journal of the EU, and the presumption holds only “to the extent that those standards cover those requirements”.

That second condition matters. A standard for quality management does not prove that a model is accurate or secure. It covers only the provision it was written for. In the case of EN 18286:2026, the Commission says the standard gives a presumption of conformity with the parts of Article 17 that it covers. Article 17 is the AI Act provision on quality management systems.

Use is voluntary. The Commission’s standardisation page states that companies applying harmonised standards are presumed compliant, but that other frameworks can also be used to demonstrate compliance. A provider that takes another route carries the burden of showing that it works.

Who writes the standards and how one becomes official

Harmonised standards are not written by the Commission. The Commission sends a standardisation request to the European standardisation organisations CEN and CENELEC. For the AI Act, that request is referenced as C(2025)3871 and covers ten areas: risk management, data governance and dataset quality, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management and conformity assessment.

CEN and CENELEC work through a joint technical committee, JTC 21, and say they align with international work such as ISO/IEC SC 42. Once a standard is published, the Commission assesses whether it meets the AI Act’s objectives and legal requirements. Only after that check is it referenced in the Official Journal, and only then does the presumption start.

Quality management was the first of the ten areas to get there. The draft, then called prEN 18286, entered public enquiry on 30 October 2025. The Commission’s decision citing the final standard is Implementing Decision (EU) 2026/2274, published on EUR-Lex.

What happens when no standard arrives

The AI Act includes a fallback. Article 41 lets the Commission adopt “common specifications” through implementing acts, but only if standardisation has failed. That means the standardisation bodies refused, missed the deadline or did not follow the request, and no standard reference has been published or is expected within a reasonable time.

Common specifications give the same kind of presumption of conformity. They are also temporary by design. If a harmonised standard is later referenced in the Official Journal, the Commission must repeal the overlapping implementing acts.

The fallback explains why the pace of standard writing is a political topic. Standards that arrive late leave providers without a clear route, while the legal requirements keep their dates. In our reporting, the compliance consultancy DQS said JTC 21 missed its autumn 2025 deadline, a claim the Commission has not confirmed.

Why a presumption is helpful and where it stops

For providers, the benefit is predictability. A standard that is referenced in the Official Journal tells them what “good enough” looks like for one requirement. It can also be folded into systems they already run. The Commission says EN 18286 is designed to sit on top of international standards such as ISO/IEC 42001 and ISO 9001, or a sector system such as ISO 13485 for medical devices.

The limits are real, though:

• Partial coverage. Nine of the ten requested areas have no referenced standard yet. Providers still need other evidence for risk management, data quality, human oversight, accuracy and cybersecurity.
• A presumption is not immunity. It shifts the starting assumption. It does not stop authorities from acting, and the Commission can withdraw a reference, which would end the presumption for later users.
• Paperwork is not performance. A quality management standard checks that processes exist and are followed. It does not measure how well a particular model behaves.
• Open questions on practice. It is not yet clear how national authorities and conformity assessment bodies will apply the presumption day to day.

Signals to watch as more standards land

The first thing to watch is the next reference in the Official Journal. The Commission says further harmonised standards are expected but has not given a schedule. Each new one will cover another slice of the ten areas, and the presumption will grow slice by slice.

The second is timing. The Commission places the high-risk requirements at December 2027 and August 2028, depending on system type, instead of the original 2 August 2026. Whether the remaining standards arrive before those dates will decide how much of the shortcut is available when enforcement begins.

The third is the fallback. If standards stall in an area, the Commission can use Article 41 and issue common specifications. Watching which route a given requirement takes will show how the AI Act’s technical rules are actually being built.